Telnet is enabled: your admin password travels in plain text

What the audit found

The telnet service under IP → Services is enabled on your router. Telnet is a command-line login on TCP port 23 that dates from a time before encryption was normal. Every byte of a Telnet session — the user name, the password and every command typed afterwards — crosses the network in readable form.

The audit rates this critical when the service is reachable from the internet, high when it is reachable from a limited set of external addresses, and medium when only your internal network can reach it. Even the internal case is worth fixing: there is no situation in which Telnet is the right tool on RouterOS.

Why it matters

Two separate problems come together here.

The first is eavesdropping. Anyone positioned on the path between you and the router — a compromised switch, a rogue WiFi access point, an ISP hop, or malware on a PC in the same LAN — can read the session as it goes by. That includes your admin password. With Winbox or SSH the same observer sees only encrypted traffic.

The second is exposure. When Telnet is reachable from the internet, it is an open invitation to automated password guessing. Port 23 is scanned constantly, mostly by botnets looking for devices with default or weak credentials; the Mirai family and its descendants were built almost entirely on Telnet logins. A router that answers on port 23 will see login attempts within minutes of going online, and a weak password will fall.

Together they mean that an enabled Telnet service turns any password weakness or any observer on the network into full control of the router — the ability to change firewall rules, redirect DNS, install scripts, and use the device against the rest of your network. On a device that exists to protect the network, that is as bad as it gets.

What it looks like in Winbox

Open IP → Services. Find the row named telnet. If it is shown in normal (not greyed) text, the service is enabled. The Port column will usually read 23 and the Available From column is often empty, which means any address may connect.

In the same list, a disabled service is greyed out and carries a disabled flag; an enabled Telnet row has neither.

How to fix it

The fix is to disable the Telnet service under IP → Services — that is the whole change, and RouterOS keeps it across reboots and upgrades. Every RouterOS device offers SSH, which gives the same command-line session over an encrypted transport.

Before you do it, make sure you have another way in. Winbox and SSH are the normal choices. If you have been using Telnet from a script or a monitoring tool, switch that tool to SSH first; the commands you send inside the session are identical, only the transport changes. Check the SSH row in the same services list: if it is disabled, enable it and, in the same step, fill in the Available From field with your management subnet so that the replacement is not exposed any wider than Telnet was.

Disabling Telnet cannot lock you out of Winbox or SSH, so Safe Mode is not strictly needed here, but it does no harm to use it if you are making several changes at once. If the audit also reported that your input chain does not drop traffic from the WAN, fix that as well; disabling Telnet removes one door, the firewall closes the rest.

Afterwards, try a Telnet connection to the router from a machine on your LAN — it should be refused — and from outside (a phone on mobile data) the same attempt on your public address should time out. Confirm in IP → Services that the telnet row is now greyed out, then re-run the audit; the finding should be gone.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I only use Telnet from inside my LAN. Is it still a problem?

It is less urgent, which is why the audit rates it lower, but it is still worth switching off. Anything on your LAN that can capture traffic — an infected PC, a guest device, a badly isolated WiFi — sees your admin password. SSH costs nothing and removes that risk entirely.

Will disabling Telnet break my monitoring or backup scripts?

Only if they log in over Telnet. Most tools that automate RouterOS support SSH out of the box, and the commands you send are exactly the same. Update the connection type in the tool, test it once, and then disable Telnet.

Is changing the port to something other than 23 an acceptable alternative?

No. The password is still sent in clear text on any port, and scanners find Telnet by the way it answers rather than by port number. Disable it.